Scanning a QR code to view a restaurant menu, pay for parking, or access a tourist brochure has become routine for millions of people. But cybercriminals have also seen a golden opportunity in this. What was once a simple square with black dots now hides the gateway to a fraudulent network that is rapidly expanding in Europe and Spain. The technique is called quishing, and it is already one of the fastest-growing phishing methods worldwide.
The data handled by cybersecurity companies leaves little room for doubt. Microsoft detected 18,7 million quishing attacks in March 2026 alone, compared to 7,6 million in January , representing a 146% increase in just three months. In the first quarter of 2026, the company identified nearly 8.300 billion email phishing threats, with malicious QR codes being the fastest-growing channel. Logicalis Spain and its cybersecurity unit, Áudea, have been warning their clients for months that QR codes are a real attack vector, far more dangerous than they appear because they operate outside the usual controls of corporate computers.
What is quishing and why is it so dangerous?
Quishing is a variant of classic phishing that replaces traditional links with QR codes. When scanned with a mobile phone, the user ends up on a fraudulent page that replicates the appearance of a legitimate service , whether it's a bank, a shipping company, an authentication platform, or a well-known store . The difference from a normal link is obvious: the human eye cannot see the web address hidden behind the code, and the entire process takes place on the phone, far from the security barriers that typically protect a company's computers. Andrés Cartes Guilarte, Cybersecurity Culture Consultant at Áudea, summarizes the threat clearly: the QR code moves the interaction outside the conventional security perimeter, making it a terrible tool for stealing credentials, personal data, or banking information.
Over the past few months, attackers have refined their targeting techniques. PDF files have become one of their favorite hiding places. Malicious PDFs accounted for approximately 70% of QR code attacks recorded in March 2026 , according to Barracuda's Email Threats Report, and 70% of the analyzed documents contained codes that led to phishing pages. For malicious Microsoft 365 files, that percentage reached 56%. Furthermore, codes embedded directly into the email body saw a 336% increase that same month. The formula is simple: a seemingly routine email, a suspicious-looking attached PDF, and a QR code that, when scanned, leads directly to a trap.
QR code fraud is also happening on the street and in restaurants
The problem doesn't stay in the inbox. QR codes have become so integrated into the physical world that cybercriminals only had to take one more step: manipulating the elements that people already use every day. On August 4, 2026, INCIBE warned of a real case in Spain in which a user scanned a restaurant menu QR code, clicked on a pop-up window, and activated an unwanted premium subscription. Other customers of the same establishment had experienced similar situations. The Spanish Civil Guard has repeatedly warned about the physical replacement of these codes: criminals place a sticker over the original QR code, and when the customer scans it, they are taken directly to a fraudulent website without noticing.
At the same time, the "fake delivery" scam has become one of the most widespread variations. The scammer sends an SMS or WhatsApp message impersonating a legitimate courier company, complete with logo and a sense of urgency: "Your order could not be delivered," "Please confirm your address to receive the package." The message includes a QR code or link that leads to a replica of a well-known shipping company's website. From there, the fake page requests personal information, address, ID number, and, often, bank card details under the pretext of paying customs duties or a reshipping adjustment. With this information, the criminals make online purchases, empty bank accounts, and even install malicious applications with remote access to the device.
The normality of the QR code helps the deception work
Part of the success of this type of fraud lies in how natural it is to scan a code in any context. Data from QR Tiger indicates that 75% of restaurants worldwide already use QR codes for their digital menus , and the use of this technology in marketing and advertising skyrocketed by 323% between 2021 and 2023. With such widespread adoption, it's almost impossible for users to stop and consider whether the code they just scanned has been manipulated. QR codes are as commonplace as paying with a card or opening a messaging app, and that's precisely what attackers exploit.
Protection should be twofold: preventative measures before scanning and knowing how to react if you've already fallen into the trap. Experts recommend being wary of any message with an urgent tone that asks you to confirm delivery or account details. If you receive a notification from a shipping company, the safest option is to go directly to the company's official app or website, locate the order using the tracking number, and disregard the QR code or link in the message. No legitimate logistics company asks for your card number via WhatsApp or SMS to "release" a package. It's also advisable to check, before using it, that the QR code on a restaurant table hasn't been covered with a suspicious sticker, and verify the URL it redirects to before entering any information.
What to do if you've already fallen for the quishing
If the victim has already entered their information on a fake website, the first step should be to notify the bank and block the card . Next, change the passwords for any accounts that may have been compromised and review recent transactions over the following weeks. Reporting the phone number or message to the authorities and the telecommunications company helps identify and block these fraud patterns more quickly, as well as protecting future victims. Experts remind us that quishing is not an isolated incident, but a method that is constantly being refined, so caution and common sense are the best tools to avoid falling victim to the scam.